docs: add EXCEPTIONS.md and SBOM/CVE badges to README

Author: wishuponascar22

EXCEPTIONS.md

@@ -0,0 +1,16 @@
+# Dependency Security Exceptions
+
+No active exceptions at this time.
+
+---
+
+## Exception Template
+
+| Field | Details |
+|-------|---------|
+| **Package** | Name and version range |
+| **CVE / Risk** | CVE ID or risk description |
+| **Justification** | Why remediation isn't immediate |
+| **Compensating Control** | What mitigates the risk |
+| **Review Date** | When this will be re-evaluated |
+| **Sign-off** | wishuponascar22 |

README.md

@@ -7,7 +7,9 @@
 [![RealAgentID](https://img.shields.io/badge/RealAgentID-v0.1-00e5a0.svg)](https://github.com/wishuponascar22/RealAgentID)
 [![Status: Alpha](https://img.shields.io/badge/status-alpha-orange.svg)](https://github.com/TrailStax/StaxVault)
 [![OWASP Agentic](https://img.shields.io/badge/OWASP-Agentic%20Top%2010-red.svg)](docs/TrailStax_OWASP_Gap_Analysis.docx)
-
+[![SBOM](https://img.shields.io/badge/SBOM-CycloneDX-blue)]
+[![SLSA](https://img.shields.io/badge/SLSA-Level%202-green)]
+[![CVE Scan](https://github.com/TrailStax/StaxVault/actions/workflows/sbom.yml/badge.svg)]
 -----
 
 ## What TrailStax Is
@@ -311,4 +313,4 @@ MIT — Use it, build on it, cite it when you publish.
 
 -----
 
-*Built by [CrossroadCode](https://github.com/wishuponascar22) — at the crossroads of trust and automation.*
+*Built by [CrossroadCode](https://github.com/wishuponascar22) — at the crossroads of trust and automation.*